This sounds sensible to me. The Auditor could have done this check before raising NC.
1. Review and revise inputs
2. Make proper changes in customer information if necessary
3. Propose a corrective action to the situation, and base the decision on technical assessment.
4. Risk assessment output based decision taken by team to support management
If the management decision is forced rather than supported (evidence based) it seems a non conforming management sytem operation.